Write resolved constraints to [tool.uv] constraint-dependencies

[jensens]

Summary

The uv hook now writes the fully resolved constraints — including external -c/-r chains such as Plone release constraints (-c https://dist.plone.org/...) — into [tool.uv] constraint-dependencies. uv itself cannot follow -c URL includes, so previously the uv sync path silently lost those pins. mxdev already resolves the whole chain (HTTP + caching + recursion) during the read phase into state.constraints; this change just consumes that data — no new fetch logic.

• New pure function _constraints_to_uv() turns resolved constraint lines into ordered ("comment"|"entry", text) items: specifier lines become array entries, comment lines (provenance # begin/end constraints from, # … -> mxdev disabled markers) are preserved, decorative #### rules / blanks / non-PEP-508 lines dropped.
• _update_pyproject() builds a tomlkit multiline array (managed marker + comments + entries) and fully owns/replaces [tool.uv] constraint-dependencies.
• Source order preserved (no sorting), no dedup/conflict resolution — semantically identical to the classic constraints-mxdev.txt passthrough; uv handles conflicts as pip does.
• Default-on when [tool.uv] managed = true; opt-out via uv-constraint-dependencies = false in [settings].
• Packages developed from source or replaced via version-overrides stay excluded (they come through [tool.uv.sources] / override-dependencies); their disabled-markers are kept as comments.

Idempotency (byte-identical rewrites) was de-risked via a tomlkit spike and is covered by a test.

Inspired by Maik Derstappen's uv-import-constraint-dependencies (attribution added to README).

Test Plan

• pytest — 223 passed, 4 skipped (pre-existing hg/svn)
• uvx --with tox-uv tox -e lint — clean
• 8 new uv tests: filter/order unit tests, write/opt-out/replace/idempotency/stale-removal integration tests, and an end-to-end test driving the real read() + hook over a local -c chain

[erral]

Tested and OK.

To include this in cookieplone-templates we would need further discussion because it would mean to remove repoplone part of downloading the dependencies from the equation, and adding a requirements.txt.